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A theoretical quantum key distribution scheme using EPR pairs is presented. This scheme 
is efficient in that it uses all EPR pairs in distributing the key except those chosen for checking 
eavesdroppers. The high capacity is achieved because each EPR pair carries 2 bits of key code. 
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Since languages become the tool for communication, the desire and need to transmit secret messages from one person 
to another begin. Then human have the cryptography - an art to transmit information so that it is unintelligible and 
q ' therefore useless to those who are not meant to have access to it. The most important classic cryptographic scheme 
is public-key crypto-system jjj, its safety relies on the high complexity of the underlying mathematical problems, for 
instance the factorization of large numbers. But with the development of the quantum computation(QC), especially 
the Shor's algorithm for factoring big numbers, the systems once seemingly unbroken in practice will be agressed 
easily. Now in the information community, the safety of transmission of secret information is becoming more and more 
concerned. One essential theme of secure communication is to distribute secret keys between senders and receivers. 
• Quantum mechanics, one of the greatest discovery of the 20th century, has now entered the field of cryptography: if 
^ ' the key distribution makes use of quantum states, an eavesdropper can not measure them without disturbing them, 
i The principle of the quantum mechanics can help to make the key distribution secure. Upto now, there have already 
been several quantum key distribution(QKD) schemes: BB84 protocol 0, the EPR scheme (|Q|,B92 the 4+2 
protocol ||, the six-state protocol (7), the Goldenberg/Vaidman scheme [fB|, Koashi/Imoto scheme M, and the recent 
Cabello protocol and so on. 

Experimental research on QKD is progressing very fast, for instance the optical-fiber experiment of BB84 and B92 
protocols have been realized upto 48 km p"l[ and experiment in free space of B92 scheme has been achieved over 1 
km distance JT2) , and very recently upto 1.6 km during daylight . 

Before presenting our scheme, we first introduce the notations. An EPR pair is one of the 4 Bell states 
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Alice and Bob agree beforehand that | if)\), \ ips), | ips), | -04) are encoded as 00,01,10,11 respectively. 
This coding increases the capacity of our scheme. An ordered N EPR particle pair sequence is denoted by 
[(Pi(l),Pi(2)),(P 2 (l),P 2 (2)), (P i (l),P(2)) ) ... ) (P v (l),Pv(2))]. We denote P,- (1) for one particle in the i-th EPR 
pair, and Pj(2) for the other, and i — 1, 2, . . . , N. We say that Pi(l) is the EPR partner particle of P*(2) and vice 
versa. The order of these N EPR pairs is maintained through out the QKD process. We can also take one EPR 
partner particle Pj(l) from each EPR pair (Pj(l), Pj(2)) to form an EPR partner particle sequence [Pi(l), P 2 (l), 
Pi(l), Pjv(l)]. A Bell-basis measurement is joint measurement of two particles onto the 4 Bell basis states. 
Our protocol is as follows: 

(1) Alice produces an ordered N EPR pair sequence, [(Pi(l), Pi (2)), (P 2 (l), P 2 (2)), (P(1),P(2)), 
(Pv(l),Pv(2))]. 

(2) Then Alice takes one particle from each EPR pair to form an ordered EPR partner particle sequence: [Pi (2), 
P 2 (2), Pj(2), ...,Pjv(2)]. The rest of the EPR partner particles form another ordered EPR partner particle sequence: 
[Pi(l), P 2 (l), P3(l), ...,Pv(l)]. Alice sends to Bob one ordered EPR partner particle sequence: [Pi (2), P 2 (2), P 3 (2), 
...,Pv(2)]. 
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(3) After Bob receives the ordered EPR partner particle sequence, he chooses randomly among the EPR partner set 
a sufficiently large subset and performs measurement on the particles in the subset. The result of this measurement 
will be either or f . Bob stores the rest of the particles of his EPR particle sequence. 

(4) Then Bob tells Alice through a classical channel (such as a telephone line) that he has received the particle 
sequence, and the particles that he has chosen to measure in a some direction. After hearing from Bob, Alice then 
performs measurement on the partner subset of those particles whose partner has been measured by Bob. Alice and 
Bob then publicly compare the results of these measurement to check evesdropping. We refer this procedure as the 
first evesdropping check. 

(5) If they are certain that there is no evesdropping, then Alice sends Bob the remaining EPR particle sequence: 
[-Pi(l), £"2(1), £3(1)7 •••j-FV(l)]- Of course, the particles that have been measured are dropped from this particle 
sequence. 

(6) After Bob receives these N particles, he takes one particle from each particle sequence in order and performs 
Bell-basis measurement on them. He records the results of the measurements. 

(7) Alice and Bob choose a sufficiently large subset of these Bell-basis measurement results to check if the QKD is 
successful. If the error rate in this check is below certain threshod, then the Bell-basis measurement results are taken 
as raw keys. We call this procedure as the second evesdropping check. 

The procedure is shown in Fig. 1. During the transmission of the second particle sequence, Eve can not get access 
to the EPR pairs, hence can not steal the key. Her action just causes disturbance to the key, which in fact is a kind 
of destruction. The second evesdropping check is designed for detecting this. In practice, this procedure may well be 
combined with the privacy amplification procedure in the post-processing stage of QKD. Next we discuss the security 
of the protocol. 

First, the scheme is secure against direct measurement by Eve. In this attack, Eve intercepts the first particle 
sequence and makes measurements on them, then she resends these measured particle sequence to Bob. Because 
of Eve's measurement, all the EPR pairs, with one particle sequence at Alice's hand and the other particle set at 
Bob's hand, are destroyed. During the first evesdropping checking procedure, Eve's destruction is not detectable 
because Bob's measurement will yields exactly the same results as Eve which is consistent with the results of Alice's 
measurement. However during the second evesdropping check, Eve's action is easily detected. Because the EPR pairs 
have collapsed, Bob will have only 50% probability of obtaining the right result when Bob uses Bell-basis measurement 
to "read" his "EPR" particle pairs. For instance, suppose 1 00) + |11) is collapsed into 1 00) by Eve's interception. Since 

100) = -L|^> + i|v*>, 

Bob has only 50% to obtain when he makes a Bell-basis measurement. In order words, the error rate will be as 
high as 50%, and this can be easily detected. Eve can not obtain any useful information from this destructive attack. 

Secondly, the scheme is secure against the intercept-resend attack. Suppose Eve intercepts the particle sequence 
{Pj(2), i = 1, N} and keeps them. However she can not make Bell-basis measurement because she does not possess 
the other particle sequence. In order to obtain the other particle sequence, she must send a fake particle sequence 
to Bob so that Bob can notify Alice. The particle sequence sent by Eve to Bob may well be a particle sequence 
from an EPR pair sequence [(P x *(l), P 1 *(2)), (P 2 *(l), P 2 *(2)), (P*(l), P*(2)), (P£(l), P£(2))]. However this can 
be detected easily during the first evesdropping check. Bob chooses randomly a subset of particles and measures 
them. After Bob tells Alice what particles he has measured, Alice measures the corresponding particles at her hands. 
Then Alice and Bob publicly compare their results. If Bob's particle sequence is the fake particle sequence sent by 
Eve, half of his results during the first evesdropping check will be inconsistent with that of Alice. This will easily 
detect Eve. We can see this more clearly by studying the mutual information defined as ]Tc|| 

I(X : Y) = H(X) - H(X\Y), 

where H(X) — — ^2 i p(xi)\og 2 p(xi) is the Shannon entropy, which is a function of the probabilities p(xi) of all 
possible values of X, and the sum is over those i with p(xi) > 0. H(X\Y) is the expected entropy of X once one 
knows the value of Y, and is given by 



H(x\Y) = J2p(y 1 ) 



^2p(x i \y j )log 2 p(x i \y j ) 



If there is no evesdroping, the mutual information between Alice and Bob is Iab = 2, and the mutual information 
between Alice and Eve is zero. When there is evedropping, the mutual information between Alice and Eve is Iae = 2, 
and the mutual information between Alice and Bob is Iab = 0. Evedropping in this scheme is easily detected. 
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This is compared with the BB84 protocol in which Eve evesdrops with the same method as Bob, Iab — 5/8 log 2 5 + 
3/81og 2 3 — 2 = 0.046, and Iae = Ieb = 3/41og 2 3 — 1 = 0.189. When there is no evedropping, the mutual information 
between Alice and Bob in the BB84 scheme is Iab — 3/41og 2 3 — 1 = 0.189. 

Thirdly, the scheme is safe against the opaque attack strategy. In this strategy Eve intercepts every signal and 
measures them. If she gets a result, she just let the signal go. Otherwise she destroys the signal completely. In our 
scheme Eve can not use this strategy, because Alice sends to Bob only one particle sequence at a time. This particle 
sequence is useless without the other particle sequence. If Eve tries to hide something, the QKD process simply 
stopped. 

Like other QKD protocols using orthogonal states, one distinct feature of our scheme is its high efficiency in terms 



of number of keys sent to the number of EPR pairs (particles) used 10 . This is different from the EPR protocol or 
the BB84 protocol where only half of the EPR pairs or particles are used as keys. We now study the efficiency of the 
scheme. The information-theoretic efficiency defined in Ref. |L0| is 

where b s is the number of secret secret bit received by Bob, qt is the number of qubit used, bt is the number of classical 
bits exchanged between Alice and Bob during the QKD process. Here the classical bits used for evesdropping checking 
have been neglected. As has been discussed by Cabello |l(]], in the BB84 protocol, b s — 0.5, q t = 1 and b t — I. b t — 1 
bit is used to indicate whether Alice and Bob use the same measuring apparatus. In this way, the efficiency of BB84 
is 25%. Similarly the EPR protocol is 50%. The protocol present here becomes 100%. 

Another feature of our scheme is its high capacity since the 4 possible states of the EPR pair carry two bits of 
information whereas in the EPR scheme(BB84) each adopted EPR pair(particle) carries only one bit of information, 
in other words, N adopted EPR pairs can send 2N bits of key in our scheme. 

Townsend has introduced a protocol to distribute secret keys to multi- users over optical fiber networks |jl6| . 
Townsend's protocol is a one-to-any protocol, where Alice acts as a single controller to establish and update a distinct 
secret key with each network user. An any-to any protocl has been proposed to allow any two users to establish 
a secret key over an optical network by Phoenix et al |l7| . The present scheme can be generalized to distribute 
secret keys to multiple legitimate users. The present is different from the previous two protocols in that the secret 
keys are common to all legitimate users. The procedure is given in the following. After Alice has sent the keys to 
Bob. Bob can create an EPR pair sequence which carries the raw keys. Then he uses this EPR pair sequence to 
another legitimate user, Clare, using the same procedure as before. The key common to Alice, Bob and Clare are 
those Bell-basis measurement results that are not chosen to check eavesdropping. In this way, the protocol can be 
generalized to a multi-party common key distribution protocol. 

The implementation of the protocol proposed here require commensurate effort. Since it employs Bell state mea- 
surements, its practical implementation is difficult. Nevertheless, it is worth pointing that the operations employed 
here are all realizable in principle, for instance, the Bell-basis measurement was used in dense coding Jl5[ . Recently 
complete Bell measurement has been realized in experiment | fL8| . The sending of EPR partner particles was used in 
quantum clock synchronization JlSj ] . Storage of light has been realized recently ]2(i| , pl| , and this may well serve to 
register the coming the particle sequences and to store them. However, for a realistic implementation of the QKD 
scheme here, the efficiency of the Bell-basis detection and the length of time of photon storage need be enhanced. 

In conclusion, we propose a new QKD scheme, it is secure, efficient and has high capacity. 
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Figure caption 

Fig. 1 . Schematic illustration of the new QKD scheme 
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